@varlock/bumpy 1.1.0 → 1.2.1

package/README.md

@@ -0,0 +1,256 @@
+<p align="center">
+  <a href="https://bumpy.varlock.dev" target="_blank" rel="noopener noreferrer">
+    <img src="https://raw.githubusercontent.com/dmno-dev/bumpy/refs/heads/main/images/github-readme-banner.png" alt="Bumpy banner">
+  </a>
+</p>
+<br/>
+<p align="center">
+  <a href="https://npmjs.com/package/@varlock/bumpy"><img src="https://img.shields.io/npm/v/@varlock/bumpy.svg" alt="npm package"></a>
+  <a href="https://github.com/dmno-dev/bumpy/blob/main/LICENSE"><img src="https://img.shields.io/npm/l/@varlock/bumpy.svg" alt="license"></a>
+  <a href="https://github.com/dmno-dev/bumpy/actions/workflows/ci.yaml"><img src="https://img.shields.io/github/actions/workflow/status/dmno-dev/bumpy/ci.yaml?style=flat&logo=github&label=CI" alt="build status"></a>
+  <a href="https://chat.dmno.dev"><img src="https://img.shields.io/badge/chat-discord-5865F2?style=flat&logo=discord" alt="discord chat"></a>
+</p>
+<br/>
+
+# @varlock/bumpy 🐸
+
+A modern package versioning and changelog generation tool — built for monorepos (works great in single packages too).
+
+## How It Works
+
+Bumpy uses **bump files** (you may know them as "changesets" if coming from [that tool 🦋](https://github.com/changesets/changesets)) — small markdown files that declare an intent to release packages with a bump level (patch/minor/major), and a description that ends up in changelogs. Developers create these files as part of their PRs, and these files are then used to consolidate changes, generate changelogs, and trigger publishing. Specifically:
+
+- Devs/agents create bump files as part of their PRs (using `bumpy add` or manually)
+- A pre-push git hook can enforce bump files exist for changed packages
+- In CI, a workflow checks PRs for bump files, leaves a comment on the PR detailing changed packages
+- As PRs merge to the base branch, a "release PR" is kept up to date
+  - Shows what packages will be released and their changelogs
+    — Including packages bumped automatically due to dependency relationships
+- When release PR is merged, publishing is triggered
+  - Oending bump files are deleted and packages are published with updated versions and changelogs
+
+All of this is automated via two simple GitHub Actions workflows (see [CI setup](#ci--github-actions) below). You can also run everything locally with `bumpy status`, `bumpy version`, and `bumpy publish`.
+
+### Example bump file
+
+`.bumpy/add-user-language.md`:
+
+```markdown
+---
+'@myorg/core': minor
+'@myorg/utils': patch
+---
+
+Added user language preference to the core config.
+Fixed locale fallback logic in utils.
+```
+
+## Features
+
+- **All package managers** — npm, pnpm, yarn, and bun workspaces
+- **Smart dependency propagation** — configurable rules for how version bumps cascade through your dependency graph (see [version propagation docs](https://github.com/dmno-dev/bumpy/blob/main/docs/version-propagation.md))
+- **Pack-then-publish** — by default, publishes to npm (resolving `workspace:` and `catalog:` protocols, with OIDC/provenance support). Per-package custom publish commands let you target anything — VSCode extensions, Docker images, JSR, private registries, etc.
+- **Flexible package management** — include/exclude any package individually via per-package config, glob patterns, or `privatePackages` setting
+- **Non-interactive CLI** — `bumpy add` works fully non-interactively for CI/CD and AI-assisted development
+- **Aggregated GitHub releases** — optionally create a single consolidated release instead of one per package
+- **Auto-generate from commits** — `bumpy generate` creates bump files from branch commits — works with any commit style, with enhanced detection for conventional commits
+- **Pluggable changelog formatters** — built-in `"default"` and `"github"` formatters, or write your own
+- **Zero runtime dependencies** — dependencies are minimal and bundled at release time
+
+## Getting Started
+
+```bash
+# Install
+bun add -d @varlock/bumpy  # or npm/pnpm/yarn
+
+# Initialize (creates .bumpy/ directory and config, migrates from changesets if applicable)
+bunx bumpy init
+
+# Create a bump file
+bunx bumpy add
+
+# Preview the release plan
+bunx bumpy status
+```
+
+Then set up CI to automate versioning and publishing (see below).
+
+## CI / GitHub Actions
+
+No GitHub App to install, no separate action to rely on — just call `bumpy ci` directly in your workflows. Two commands handle the entire release lifecycle:
+
+- **`bumpy ci check`** — runs on every PR. Computes the release plan from pending bump files and posts/updates a comment on the PR showing what versions would be released. Warns if any changed packages are missing bump files.
+- **`bumpy ci release`** — runs on push to main. If pending bump files exist, it opens (or updates) a "Version Packages" PR that applies all version bumps and changelog updates. If the current push _is_ the Version Packages PR being merged, it publishes the new versions, creates git tags, and creates GitHub releases.
+
+_examples use bun, but works with Node.js_
+
+### PR check workflow
+
+```yaml
+# .github/workflows/bumpy-check.yml
+name: Bumpy Check
+on: pull_request
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v6
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install
+      - run: bunx @varlock/bumpy ci check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BUMPY_GH_TOKEN: ${{ secrets.BUMPY_GH_TOKEN }} # additional PAT (optional)
+```
+
+### Release workflow
+
+```yaml
+# .github/workflows/bumpy-release.yml — trusted publishing (OIDC, no secret needed)
+name: Bumpy Release
+on:
+  push:
+    branches: [main]
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write # required for npm trusted publishing (OIDC)
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: oven-sh/setup-bun@v2
+      - uses: actions/setup-node@v6
+        with:
+          node-version: lts/*
+      - run: bun install
+      - run: bunx @varlock/bumpy ci release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BUMPY_GH_TOKEN: ${{ secrets.BUMPY_GH_TOKEN }} # additonal PAT, needed to trigger CI checks on release PR
+```
+
+> **Trusted publishing setup:** Configure each package on [npmjs.com](https://docs.npmjs.com/trusted-publishers/) → Package Settings → Trusted Publishers → GitHub Actions. Specify your org/user, repo, and the workflow filename (`bumpy-release.yml`). No `NPM_TOKEN` secret needed. Requires npm >= 11.5.1 — bumpy will warn if your version is too old.
+
+<details>
+<summary>Alternative: token-based auth (NPM_TOKEN secret)</summary>
+
+```yaml
+# .github/workflows/bumpy-release.yml — token-based auth
+name: Bumpy Release
+on:
+  push:
+    branches: [main]
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install
+      - run: bunx @varlock/bumpy ci release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BUMPY_GH_TOKEN: ${{ secrets.BUMPY_GH_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+```
+
+</details>
+
+You can also use `bumpy ci release --auto-publish` to version + publish directly on merge without the intermediate PR.
+
+### Token setup
+
+The default `github.token` works for basic functionality, but GitHub's anti-recursion guard means PRs created by the default token won't trigger other workflows — so your regular CI (tests, linting, etc.) won't run automatically on the Version Packages PR. To fix this, provide a `BUMPY_GH_TOKEN` secret using either a **fine-grained PAT** or a **GitHub App token**. See the [full token setup guide](https://github.com/dmno-dev/bumpy/blob/main/docs/github-actions.md#token-setup) for details.
+
+Run `bumpy ci setup` for interactive guidance, or set it up manually:
+
+1. Create a [fine-grained personal access token](https://github.com/settings/personal-access-tokens) with:
+   - **Repository access:** your repo only
+   - **Permissions:** Contents (read & write), Pull requests (read & write)
+2. Add it as a repository secret named `BUMPY_GH_TOKEN`
+3. Add it to your release workflow:
+   ```yaml
+   - run: bunx @varlock/bumpy ci release
+     env:
+       GH_TOKEN: ${{ github.token }}
+       BUMPY_GH_TOKEN: ${{ secrets.BUMPY_GH_TOKEN }}
+   ```
+
+### Local versioning and publishing
+
+If you prefer to version and publish locally instead of via CI:
+
+```bash
+bumpy version   # consume bump files, update versions and changelogs
+bumpy publish   # pack and publish, create git tags, push tags, and create GitHub releases
+```
+
+## AI Integration
+
+Bumpy ships with an AI skill that teaches LLMs how to create bump files.
+
+```bash
+bumpy ai setup --target claude    # installs Claude Code plugin
+bumpy ai setup --target opencode  # creates OpenCode command file
+bumpy ai setup --target cursor    # creates Cursor rule file
+bumpy ai setup --target codex     # creates Codex instruction file
+```
+
+The skill teaches the AI to examine git changes, identify affected packages, choose bump levels, and create bump files with `bumpy add`. It also instructs the AI to keep existing bump files up to date as work continues on a branch — updating packages, bump levels, and summaries to reflect the final state of changes.
+
+## Documentation
+
+- [Bump file format](https://github.com/dmno-dev/bumpy/blob/main/docs/bump-files.md) — syntax, bump levels, cascade control
+- [Configuration reference](https://github.com/dmno-dev/bumpy/blob/main/docs/configuration.md) — all `.bumpy/_config.json` and per-package options
+- [CLI reference](https://github.com/dmno-dev/bumpy/blob/main/docs/cli.md) — every command with flags and examples
+- [GitHub Actions setup](https://github.com/dmno-dev/bumpy/blob/main/docs/github-actions.md) — CI workflows, token setup, trusted publishing
+- [Version propagation](https://github.com/dmno-dev/bumpy/blob/main/docs/version-propagation.md) — how dependency bumps cascade through your graph
+
+## Why files instead of conventional commits?
+
+Tools like semantic-release infer version bumps from commit messages (`feat:` → minor, `fix:` → patch). This works for simple projects but breaks down in monorepos — a single PR often touches multiple packages with different bump levels, squash merges lose per-commit metadata, and commit messages are a poor place to write user-facing changelog entries. Bump files are explicit, reviewable in the PR diff, and can describe changes in language meant for consumers rather than developers. If you prefer commit-based workflows, `bumpy generate` can bridge the gap by auto-creating bump files from your branch commits — it works with any commit style, not just conventional commits.
+
+## Why not just use changesets?
+
+Bumpy is built as a successor to [@changesets/changesets](https://github.com/changesets/changesets). Changesets is mature and widely adopted, but has stagnated — hundreds of open issues around core design problems that are unlikely to be fixed without a rewrite. See [differences from changesets](https://github.com/dmno-dev/bumpy/blob/main/docs/differences-from-changesets.md) for a detailed comparison with links to specific issues. The biggest pain points bumpy addresses:
+
+- **Sane dependency propagation** — changesets hardcodes aggressive behavior where a minor bump triggers a major bump on all peer dependents. Bumpy uses a [three-phase algorithm](https://github.com/dmno-dev/bumpy/blob/main/docs/version-propagation.md) with sensible defaults and full configurability.
+- **Workspace protocol resolution** — changesets uses `npm publish` even in pnpm/yarn workspaces, so `workspace:^` and `catalog:` protocols are NOT resolved, resulting in broken published packages.
+- **Custom publish commands** — changesets is hardcoded to `npm publish`. Bumpy supports per-package custom publish for VSCode extensions, Docker images, JSR, etc.
+- **Flexible package management** — changesets treats all private packages the same. Bumpy lets you include/exclude any package individually.
+- **CI without a separate action or bot** — changesets requires installing a [GitHub App](https://github.com/apps/changeset-bot) _and_ using a [separate GitHub Action](https://github.com/changesets/action). Bumpy replaces both with two CLI commands (`bumpy ci check` + `bumpy ci release`) that run directly in your workflows — no extra repos to trust, no app installation requiring org admin approval.
+- **Automatic migration** — `bumpy init` detects `.changeset/`, renames it to `.bumpy/`, migrates config, keeps pending files, and offers to uninstall `@changesets/cli`.
+
+## Development
+
+```bash
+bun install        # install deps
+bun test           # run tests
+bun run build      # build CLI
+bunx bumpy --help  # invoke built cli
+```
+
+## Roadmap
+
+- Prerelease mode (for now, use [pkg.pr.new](https://github.com/stackblitz-labs/pkg.pr.new) for branch preview packages)
+- Standalone binary for use outside of JS projects
+- Better support for versioning non-JS packages and usage without package.json files
+- Plugin system for different publish targets, and support multiple targets per package
+- Tracking workspace-level / non-publishable changes
+- More frogs 🐸
+
+<!-- note this readme is also used for the bumpy package! -->

package/dist/{add-BmNL5VwL.mjs → add-DF6bawDT.mjs}

@@ -1,10 +1,10 @@
 import { n as log, o as __toESM, r as require_picocolors } from "./logger-C2dEe5Su.mjs";
-import { n as exists, t as ensureDir } from "./fs-DYR2XuFE.mjs";
-import { a as loadConfig, o as loadPackageConfig, r as getBumpyDir, s as matchGlob } from "./config-B-Qg3DZH.mjs";
-import { t as discoverPackages } from "./workspace-DWXlwcH4.mjs";
+import { n as exists, t as ensureDir } from "./fs-DnDogVn-.mjs";
+import { a as loadConfig, o as loadPackageConfig, r as getBumpyDir, s as matchGlob } from "./config-D7Umr-fT.mjs";
+import { t as discoverPackages } from "./workspace-BHsAPUmC.mjs";
 import { t as DependencyGraph } from "./dep-graph-DiLeAhl9.mjs";
-import { i as writeBumpFile } from "./bump-file-DVqR3k67.mjs";
-import { r as getChangedFiles } from "./git-YDedMddc.mjs";
+import { i as writeBumpFile } from "./bump-file-C3S_bzSf.mjs";
+import { r as getChangedFiles } from "./git-H9S9z6g-.mjs";
 import { c as ot, d as yt, i as _t, l as pt, o as gt, r as Ot, s as mt, t as unwrap, u as wt } from "./clack-C6bVkGxf.mjs";
 import { n as slugify, t as randomName } from "./names-C-TuOPbd.mjs";
 import { t as require_picomatch } from "./picomatch-DMmqYjgq.mjs";
@@ -186,7 +186,7 @@ async function addCommand(rootDir, opts) {
 	if (opts.empty) {
 		const filename = opts.name ? slugify(opts.name) : randomName();
 		const filePath = resolve(bumpyDir, `${filename}.md`);
-		const { writeText } = await import("./fs-DYR2XuFE.mjs").then((n) => n.r);
+		const { writeText } = await import("./fs-DnDogVn-.mjs").then((n) => n.r);
 		await writeText(filePath, "---\n---\n");
 		log.success(`🐸 Created empty bump file: .bumpy/${filename}.md`);
 		return;

package/dist/{ai-sMYUf3lP.mjs → ai-STKnq09z.mjs}

@@ -1,5 +1,5 @@
 import { n as log } from "./logger-C2dEe5Su.mjs";
-import { d as writeText, n as exists, t as ensureDir } from "./fs-DYR2XuFE.mjs";
+import { f as writeText, n as exists, t as ensureDir } from "./fs-DnDogVn-.mjs";
 import { dirname, resolve } from "node:path";
 import { readFile } from "node:fs/promises";
 import { execSync } from "node:child_process";

package/dist/{apply-release-plan-0kH62jhu.mjs → apply-release-plan-B1Wwx3HG.mjs}

@@ -1,6 +1,6 @@
 import { n as log } from "./logger-C2dEe5Su.mjs";
-import { a as readJson, c as updateJsonFields, d as writeText, i as listFiles, l as updateJsonNestedField, n as exists, o as readText, s as removeFile } from "./fs-DYR2XuFE.mjs";
-import { r as getBumpyDir } from "./config-B-Qg3DZH.mjs";
+import { a as readJson, c as removeFile, f as writeText, i as listFiles, l as updateJsonFields, n as exists, s as readText, u as updateJsonNestedField } from "./fs-DnDogVn-.mjs";
+import { r as getBumpyDir } from "./config-D7Umr-fT.mjs";
 import { relative, resolve } from "node:path";
 import { realpathSync } from "node:fs";
 //#region src/core/changelog.ts
@@ -28,7 +28,7 @@ const defaultFormatter = (ctx) => {
 const BUILTIN_FORMATTERS = {
 	default: defaultFormatter,
 	github: async () => {
-		const { createGithubFormatter } = await import("./changelog-github-DkACMj0j.mjs");
+		const { createGithubFormatter } = await import("./changelog-github-DZSHX3Tb.mjs");
 		return createGithubFormatter();
 	}
 };
@@ -39,7 +39,7 @@ const BUILTIN_FORMATTERS = {
 async function loadFormatter(changelog, rootDir) {
 	const [name, options] = Array.isArray(changelog) ? changelog : [changelog, {}];
 	if (name === "github") {
-		const { createGithubFormatter } = await import("./changelog-github-DkACMj0j.mjs");
+		const { createGithubFormatter } = await import("./changelog-github-DZSHX3Tb.mjs");
 		return createGithubFormatter(options);
 	}
 	if (typeof name === "string" && BUILTIN_FORMATTERS[name]) {
@@ -139,7 +139,7 @@ function updateRange(range, newVersion) {
 		cleanRange = range.slice(protocol.length);
 	}
 	const prefix = cleanRange.match(/^(\^|~|>=|>|<=|<|=)?/)?.[1] ?? "^";
-	if (cleanRange === "*" || cleanRange === "") return range;
+	if (cleanRange === "*" || cleanRange === "" || cleanRange === "^" || cleanRange === "~") return range;
 	return `${protocol}${prefix}${newVersion}`;
 }
 //#endregion

package/dist/{bump-file-DVqR3k67.mjs → bump-file-C3S_bzSf.mjs}

@@ -1,9 +1,9 @@
-import { n as log } from "./logger-C2dEe5Su.mjs";
-import { d as writeText, i as listFiles, o as readText } from "./fs-DYR2XuFE.mjs";
-import { r as getBumpyDir } from "./config-B-Qg3DZH.mjs";
-import { i as jsYaml } from "./package-manager-Clsmr-9r.mjs";
+import { f as writeText, i as listFiles, s as readText } from "./fs-DnDogVn-.mjs";
+import { r as getBumpyDir } from "./config-D7Umr-fT.mjs";
+import { i as jsYaml } from "./package-manager-ByJ0wKYh.mjs";
 import { s as tryRunArgs } from "./shell-CY7OD48z.mjs";
 import { resolve } from "node:path";
+import { existsSync } from "node:fs";
 //#region src/core/bump-file.ts
 const VALID_BUMP_TYPES = new Set([
 	"major",
@@ -29,16 +29,21 @@ async function readBumpFiles(rootDir) {
 	const dir = getBumpyDir(rootDir);
 	const files = await listFiles(dir, ".md");
 	const bumpFiles = [];
+	const errors = [];
 	for (const file of files) {
 		if (file === "README.md") continue;
-		const bf = await parseBumpFileFromPath(resolve(dir, file));
-		if (bf) bumpFiles.push(bf);
+		const result = await parseBumpFileFromPath(resolve(dir, file));
+		if (result.bumpFile) bumpFiles.push(result.bumpFile);
+		errors.push(...result.errors);
 	}
 	const creationOrder = getBumpFileCreationOrder(rootDir);
 	if (creationOrder.size > 0) bumpFiles.sort((a, b) => {
 		return (creationOrder.get(a.id) ?? Infinity) - (creationOrder.get(b.id) ?? Infinity) || a.id.localeCompare(b.id);
 	});
-	return bumpFiles;
+	return {
+		bumpFiles,
+		errors
+	};
 }
 /**
 * Use `git log` to get the commit timestamp when each bump file was first added.
@@ -74,21 +79,47 @@ async function parseBumpFileFromPath(filePath) {
 }
 /** Parse bump file content (for testing) */
 function parseBumpFile(content, id) {
-	const match = content.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
-	if (!match) return null;
+	const errors = [];
+	const match = content.match(/^---\n([\s\S]*?)\n?---\n?([\s\S]*)$/);
+	if (!match) {
+		errors.push(`Bump file "${id}" has no valid frontmatter (expected --- delimiters)`);
+		return {
+			bumpFile: null,
+			errors
+		};
+	}
 	const frontmatter = match[1];
 	const summary = match[2].trim();
-	const parsed = jsYaml.load(frontmatter);
-	if (!parsed || typeof parsed !== "object") return null;
+	if (!frontmatter.trim()) return {
+		bumpFile: null,
+		errors
+	};
+	let parsed;
+	try {
+		parsed = jsYaml.load(frontmatter);
+	} catch (e) {
+		errors.push(`Bump file "${id}" has invalid YAML: ${e instanceof Error ? e.message : e}`);
+		return {
+			bumpFile: null,
+			errors
+		};
+	}
+	if (!parsed || typeof parsed !== "object") {
+		errors.push(`Bump file "${id}" has empty or invalid frontmatter`);
+		return {
+			bumpFile: null,
+			errors
+		};
+	}
 	const releases = [];
 	for (const [name, value] of Object.entries(parsed)) {
 		if (!validatePackageName(name)) {
-			log.warn(`Skipping invalid package name in bump file "${id}": ${name}`);
+			errors.push(`Invalid package name "${name}" in bump file "${id}"`);
 			continue;
 		}
 		if (typeof value === "string") {
 			if (!VALID_BUMP_TYPES.has(value)) {
-				log.warn(`Skipping unknown bump type "${value}" for ${name} in bump file "${id}"`);
+				errors.push(`Unknown bump type "${value}" for "${name}" in bump file "${id}" (expected: major, minor, patch, or none)`);
 				continue;
 			}
 			releases.push({
@@ -98,7 +129,7 @@ function parseBumpFile(content, id) {
 		} else if (value && typeof value === "object") {
 			const obj = value;
 			if (!VALID_BUMP_TYPES.has(obj.bump)) {
-				log.warn(`Skipping unknown bump type "${obj.bump}" for ${name} in bump file "${id}"`);
+				errors.push(`Unknown bump type "${obj.bump}" for "${name}" in bump file "${id}" (expected: major, minor, patch, or none)`);
 				continue;
 			}
 			const release = {
@@ -107,13 +138,19 @@ function parseBumpFile(content, id) {
 				cascade: obj.cascade || {}
 			};
 			releases.push(release);
-		}
+		} else errors.push(`Invalid value for "${name}" in bump file "${id}" — expected a bump type string or object`);
 	}
-	if (releases.length === 0) return null;
+	if (releases.length === 0 && errors.length === 0) return {
+		bumpFile: null,
+		errors
+	};
 	return {
-		id,
-		releases,
-		summary
+		bumpFile: releases.length > 0 ? {
+			id,
+			releases,
+			summary
+		} : null,
+		errors
 	};
 }
 /** Write a bump file */
@@ -143,14 +180,31 @@ function extractBumpFileIdsFromChangedFiles(changedFiles) {
 }
 /**
 * Filter bump files to only those added/modified on the current branch.
-* Returns the filtered bump files and whether any changed bump file was
-* empty (has no releases — signals intentionally no releases needed).
+* Also detects empty bump files (no releases) that still exist on disk,
+* which signal intentionally no releases needed.
+*
+* When `parseErrors` is provided, a file that exists on disk but didn't parse
+* is only treated as an "empty bump file" if it produced no parse errors —
+* otherwise it's a broken file, not an intentionally empty one.
 */
-function filterBranchBumpFiles(allBumpFiles, changedFiles) {
+function filterBranchBumpFiles(allBumpFiles, changedFiles, rootDir, parseErrors = []) {
 	const branchBumpFileIds = extractBumpFileIdsFromChangedFiles(changedFiles);
+	const branchBumpFiles = allBumpFiles.filter((bf) => branchBumpFileIds.has(bf.id));
+	let hasEmptyBumpFile = false;
+	if (rootDir) {
+		const parsedIds = new Set(branchBumpFiles.map((bf) => bf.id));
+		const bumpyDir = getBumpyDir(rootDir);
+		for (const id of branchBumpFileIds) if (!parsedIds.has(id) && existsSync(resolve(bumpyDir, `${id}.md`))) {
+			if (!parseErrors.some((e) => e.includes(`"${id}"`))) {
+				hasEmptyBumpFile = true;
+				break;
+			}
+		}
+	}
 	return {
-		branchBumpFiles: allBumpFiles.filter((bf) => branchBumpFileIds.has(bf.id)),
-		branchBumpFileIds
+		branchBumpFiles,
+		branchBumpFileIds,
+		hasEmptyBumpFile
 	};
 }
 //#endregion

package/dist/{changelog-github-DkACMj0j.mjs → changelog-github-DZSHX3Tb.mjs}

@@ -1,8 +1,22 @@
 import { s as tryRunArgs } from "./shell-CY7OD48z.mjs";
 //#region src/core/changelog-github.ts
+/** Authors filtered from "Thanks" attribution by default (e.g. bots) */
+/** Authors filtered from "Thanks" attribution by default (e.g. AI/automation bots) */
+const DEFAULT_INTERNAL_AUTHORS = [
+	"copilot",
+	"app/copilot-swe-agent",
+	"claude",
+	"dependabot",
+	"dependabot[bot]",
+	"app/dependabot",
+	"renovate[bot]",
+	"app/renovate",
+	"github-actions[bot]",
+	"snyk-bot"
+];
 /**
 * GitHub-enhanced changelog formatter.
-* Adds PR links, commit links, and contributor attribution when git/gh info is available.
+* Adds PR links, contributor attribution, and optionally commit links when git/gh info is available.
 *
 * Usage in config:
 *   "changelog": "github"
@@ -11,8 +25,9 @@ import { s as tryRunArgs } from "./shell-CY7OD48z.mjs";
 *   "changelog": ["github", { "internalAuthors": ["theoephraim"] }]
 */
 function createGithubFormatter(options = {}) {
+	const includeCommitLink = options.includeCommitLink ?? false;
 	const thankContributors = options.thankContributors ?? true;
-	const internalAuthorsSet = new Set((options.internalAuthors ?? []).map((a) => a.toLowerCase()));
+	const internalAuthorsSet = new Set([...DEFAULT_INTERNAL_AUTHORS, ...options.internalAuthors ?? []].map((a) => a.toLowerCase()));
 	return async (ctx) => {
 		const { release, bumpFiles, date } = ctx;
 		const repoSlug = options.repo ?? detectRepo();
@@ -29,7 +44,7 @@ function createGithubFormatter(options = {}) {
 			const gitInfo = resolveBumpFileInfo(bf.id, repoSlug, serverUrl, overrides);
 			const summaryLines = cleanSummary.split("\n");
 			const firstLine = linkifyIssueRefs(summaryLines[0], serverUrl, repoSlug);
-			const prefix = formatPrefix(gitInfo, serverUrl, repoSlug, thankContributors, internalAuthorsSet);
+			const prefix = formatPrefix(gitInfo, serverUrl, repoSlug, includeCommitLink, thankContributors, internalAuthorsSet);
 			lines.push(`-${prefix ? ` ${prefix} -` : ""} ${firstLine}`);
 			for (let i = 1; i < summaryLines.length; i++) if (summaryLines[i].trim()) lines.push(`  ${linkifyIssueRefs(summaryLines[i], serverUrl, repoSlug)}`);
 		}
@@ -157,10 +172,10 @@ function findBumpFileCommitInfo(bumpFileId, repo) {
 * Build the prefix portion of a changelog line: PR link, commit link, thanks.
 * Matches the format used by @changesets/changelog-github.
 */
-function formatPrefix(info, serverUrl, repo, thankContributors, internalAuthors) {
+function formatPrefix(info, serverUrl, repo, includeCommitLink, thankContributors, internalAuthors) {
 	const parts = [];
 	if (info.prNumber && info.prUrl) parts.push(`[#${info.prNumber}](${info.prUrl})`);
-	if (info.commitHash && repo) {
+	if (includeCommitLink && info.commitHash && repo) {
 		const short = info.commitHash.slice(0, 7);
 		parts.push(`[\`${short}\`](${serverUrl}/${repo}/commit/${info.commitHash})`);
 	}

package/dist/{check-BjWF6SJm.mjs → check-BJL-YDWz.mjs}

@@ -1,8 +1,8 @@
 import { n as log, o as __toESM, t as colorize } from "./logger-C2dEe5Su.mjs";
-import { a as loadConfig, o as loadPackageConfig } from "./config-B-Qg3DZH.mjs";
-import { n as discoverWorkspace } from "./workspace-DWXlwcH4.mjs";
-import { r as readBumpFiles, t as filterBranchBumpFiles } from "./bump-file-DVqR3k67.mjs";
-import { r as getChangedFiles } from "./git-YDedMddc.mjs";
+import { a as loadConfig, o as loadPackageConfig, r as getBumpyDir } from "./config-D7Umr-fT.mjs";
+import { n as discoverWorkspace } from "./workspace-BHsAPUmC.mjs";
+import { r as readBumpFiles, t as filterBranchBumpFiles } from "./bump-file-C3S_bzSf.mjs";
+import { r as getChangedFiles } from "./git-H9S9z6g-.mjs";
 import { t as require_picomatch } from "./picomatch-DMmqYjgq.mjs";
 import { relative } from "node:path";
 //#region src/commands/check.ts
@@ -11,8 +11,12 @@ var import_picomatch = /* @__PURE__ */ __toESM(require_picomatch(), 1);
 * Local check: detect which packages have changed on this branch
 * and verify they have corresponding bump files.
 * Designed for pre-push hooks — no GitHub API needed.
+*
+* Default: at least one bump file must exist, uncovered packages are warned.
+* --strict: every changed package must be covered.
+* --no-fail: warn only, never exit 1.
 */
-async function checkCommand(rootDir) {
+async function checkCommand(rootDir, opts = {}) {
 	const config = await loadConfig(rootDir);
 	const { packages } = await discoverWorkspace(rootDir, config);
 	const baseBranch = config.baseBranch;
@@ -21,8 +25,13 @@ async function checkCommand(rootDir) {
 		log.info("No changed files detected.");
 		return;
 	}
-	const { branchBumpFiles, branchBumpFileIds } = filterBranchBumpFiles(await readBumpFiles(rootDir), changedFiles);
-	if (branchBumpFileIds.size > branchBumpFiles.length) {
+	const { bumpFiles: allBumpFiles, errors: parseErrors } = await readBumpFiles(rootDir);
+	if (parseErrors.length > 0) {
+		for (const err of parseErrors) log.error(err);
+		process.exit(1);
+	}
+	const { branchBumpFiles, hasEmptyBumpFile } = filterBranchBumpFiles(allBumpFiles, changedFiles, rootDir);
+	if (hasEmptyBumpFile) {
 		log.success("Empty bump file found — no releases needed.");
 		return;
 	}
@@ -33,16 +42,34 @@ async function checkCommand(rootDir) {
 		log.info("No managed packages have changed.");
 		return;
 	}
+	const willFailNoBump = !opts.noFail;
+	if (branchBumpFiles.length === 0) {
+		(willFailNoBump ? log.error : log.warn)(`${changedPackages.length} changed package(s) missing bump files:\n`);
+		for (const name of changedPackages) console.log(`  ${colorize(name, "yellow")}`);
+		console.log();
+		log.dim("Run `bumpy add` to create a bump file, or `bumpy add --empty` if no release is needed.");
+		log.dim("To adjust which files trigger change detection, set `changedFilePatterns` in .bumpy/_config.json.");
+		if (willFailNoBump) process.exit(1);
+		return;
+	}
 	const missing = changedPackages.filter((name) => !coveredPackages.has(name));
 	if (missing.length === 0) {
 		log.success(`🐸 All ${changedPackages.length} changed package(s) have bump files.`);
 		return;
 	}
-	log.warn(`${missing.length} changed package(s) missing bump files:\n`);
+	const willFailUncovered = opts.strict && !opts.noFail;
+	(willFailUncovered ? log.error : log.warn)(`${missing.length} changed package(s) missing bump files:\n`);
 	for (const name of missing) console.log(`  ${colorize(name, "yellow")}`);
+	if (branchBumpFiles.length > 0) {
+		console.log();
+		log.dim(`Existing bump files on this branch:`);
+		for (const bf of branchBumpFiles) log.dim(`  ${getBumpyDir(rootDir)}/${bf.id}.md`);
+	}
 	console.log();
-	log.dim("Run `bumpy add` to create a bump file, or `bumpy add --empty` if no release is needed.");
-	process.exit(1);
+	if (opts.strict) log.dim("Run `bumpy add` to create a bump file. Use bump type `none` for packages that changed but don't need a release.");
+	else log.dim("Run `bumpy add` to create a bump file, or `bumpy add --empty` if no release is needed.");
+	log.dim("To adjust which files trigger change detection, set `changedFilePatterns` in .bumpy/_config.json.");
+	if (willFailUncovered) process.exit(1);
 }
 /** Map changed files to the packages they belong to */
 async function findChangedPackages(changedFiles, packages, rootDir, config) {
@@ -62,4 +89,4 @@ async function findChangedPackages(changedFiles, packages, rootDir, config) {
 	return [...changed];
 }
 //#endregion
-export { checkCommand };
+export { checkCommand, findChangedPackages };